Custom bounce notification used for certain message filters

[itinfrastructure]

Hi there i need help creating a message filter to check mail for spf and if status = fail, temperror, permerror to send it through to quarantine and send a custom notification template to the sender.

I have created a content policy to do this as well as the custom notification although i would want all spf status's being checked whilst assigning a custom notification against it.

Thanks

Mark

[Mathew Huynh]

Hello Mark,

If you wish to use a message filter (to action the emails earlier than content filters would), the easiest method i would suggest is to create a content filter with the required actions and conditions (of SPF results) with the notification to be used.

You will see the syntax of the rules there as well in the content filter, then copy it out into a message filter format.

Essentially

Filtername:

if (condition1)

{

actionone();

}

.

For example, if SPF fail, send a notification called 'test_notify' and quarantine the email.

Would look like.

SPF_fail:

if (spf-status == "fail")

{

notify ("$EnvelopeSender", "", "", "Test_Notify");

quarantine("CustomQ")

}

.

Regards,

Matthew

[itinfrastructure]

Hi Matthew appreciate the reply. I'm assuming that (spf-status == "fail") would only be applied to pra not mail from?

My example below. Curious how would i applied this to the inbound listener only?

SPF-pra-mailfrom_fail_temperror_permerror

if (spf-status("pra") == "Fail,temperror,permerror") or (spf-status("mailfrom") == "Fail,temperror,permerror")

{

notify ("$EnvelopeSender", "", "", "custom_template_notification");quarantine("Policy");

}

.

SPF-pra-mailfrom_fail_temperror_permerror

if (recv-listener == "InboundMail") and (spf-status("pra") == "Fail,temperror,permerror") or (spf-status("mailfrom") == "Fail,temperror,permerror")

{

notify ("$EnvelopeSender", "", "", "custom_template_notification");quarantine("Policy");

}

.

??

[Mathew Huynh]

Hello,

Yep those syntax will also work.

However you will need to group the two "OR" conditions together.

Eg:

if (recv-listener == "InboundMail") and ((spf-status("pra") == "Fail,temperror,permerror") or (spf-status("mailfrom") == "Fail,temperror,permerror"))

{

notify ("$EnvelopeSender", "", "", "custom_template_notification");

quarantine("Policy");

}

.

Regards,

Matthew